Week 8 - Messaging Security

This week we will be focusing on messaging security, or email security. Several terms will be defined and used this week.

Spam - illegitimate email message that is phishing or intending to do harm
Ham - legitimate email message
Spamtrap/honeypot - an email address or domain that doesn't have any filtering on it to collect spam. The spam is then analyzed to study spam trends
Botnet - a collection of computers that have been hijacked to perform an action (such as spamming) that the end user does not condone
Snowshoe spam - distributed spamming efforts across a broad footprint
Phishing - a general spam message that tries to get information that targets a wide demographic
Spear Phishing - a targeted phishing attack against a specific person or demographic
Realtime Blackhole List (RBL) - a list of known IPs that send spam
Heuristics - a spam detection technique that uses basic feature matches (strings, sender, etc) to detect spam. If a message matches the phrase "buy <product> now!" it is likely spam
Bayesean filtering - tokenize a message and calculate each token against known spam and ham corpora to determine if it has spam characteristics

Some classic spam include the Nigerian prince and their generous wealth message that we've all seen. This is classified as 419 phishing. Another classic phishing attack is the cheap drugs from a Canadian pharmacy or something along those lines. These messages have their key words in HTML <span> tags to get around heuristic rules. The Rustock botnet was the primary offender of this type of spam. Artificial inflation of stocks are another classic spam (pump and dumps).

How can spam be defended against? There are two general defense types, reputation-driven and content-driven.

Tools used to research spam:
DIG (Domain Information Groper) - used to verify DNS records to check email exchanges
WHOIS - used to get IP and domain records about the organization

There are two fundamental methods to scoring spam, additive scoring and probability scoring. With additive scoring, each "red flag" that is triggered by a message (Bayesean method used) gets a point. Once a certain threshold of points is crossed, the message is classified as spam.

Email headers contain tons of information in them. They are read from the bottom up, and contain the sender, subject, date, origin, and hop information until received by the recipient. A sample email header is below.
source: lecture slides, CS373 Defense Against the Dark Arts, Oregon State University

Another way that spam can be identified is by the shape identified in a star plot. Once a shape is determined for known spam, if a new message is very close to the same shape it is marked as spam. The same thing can be done for ham messages and now you have two visual representations of spam and ham.

Comments

Post a Comment

Popular posts from this blog

Week 5 - Windows Internals

Image
This week we will be primarily focusing on rootkits. A rootkit is a piece of malware that conceals its activities and existence from the user. The ushering in of this new era of malware came into focus in 2006 when Sony released a disk to try and prevent copying of music. In this piece of software any file that started with $sys$ was hidden from the user. Attackers saw the potential of this and gained control of this method. The majority of rootkits operate in a 32 bit Windows environment however some rootkits target a 64 bit environment. Most rootkits are at the kernel level because at this level they have full access and control to the system. The slide below is a nice illustration what the computer architecture looks like and where rootkits are located. slide source from lecture, OSU CS 373 Definitions for this week: thread - the smallest unit of execution within an operating system. The slide below has a nice demonstration of how a thread is executed hooking - redirecting...
Read more

Week 1 - Introduction to Malware

This week we were introduced to the basics of malware. The first commercial anti-virus was released in the early 1990s where updates would be distributed monthly via floppy disks. An important component in current and future anti-malware is collaboration efforts between companies. If one company remains siloed in their efforts they can miss behavior that a different company may see from the same piece of malware. The primary vector for malware is users. Next is USB drives. Some basic definitions that were covered are: DGA - domain generating algorithm that creates lots of domain names that can be used as rendezvous points for command and control servers Malware - shorthand for malicious software viruses - these are a type of malware that are polymorphic and parasitic worm - this type of virus is not necessarily parasitic, the main purpose is to spread as quickly as possible trojan - backdoor and downloader means that the hacker is controlling the host machine remotely. Tro...
Read more

Week 4 - Software Vulnerabilities and Common Exploits

Image
There are two main components to hacking, finding "bugs" in the software that allows the user to interact with a program in an unintended way and configuration vulnerabilities (an example of a configuration vulnerability is a weak password). Hacking used to primarily focus on a company's perimeter systems (parts of the system that are exposed to the internet), but as defense against those types of attacks have been improved hackers are now targeting the internal systems aka the system's users. Memory corruption is a key area that attackers can examine to try and gain access to the system. The definition used by the lecturer this week is: "Accessing (reading/writing) memory (stack/heap) in an invalid (originally unintended) way which results in an undefined behavior (what we are looking to control)." There are four common categories of memory corruption: lifetime control, uninitiated memory, array index calculations, and buffer length calculations. A stan...
Read more